GDPR & DATA PROTECTION POLICY

Purpose and scope

This policy applies to personal information processed in connection with our website, clients, prospects, suppliers, partners, workforce and operations.

Core principles

We aim to process personal information lawfully, fairly and transparently; for specified legitimate purposes; using no more information than necessary; keeping it accurate where appropriate; retaining it only as long as needed; and protecting it with proportionate security.

Lawful processing and accountability

Before processing personal information, D&A should identify a clear purpose and appropriate lawful basis. Higher-risk processing should be assessed for additional safeguards or specialist advice where appropriate.

Privacy by design and minimisation

New systems, processes and client engagements should consider privacy from the outset. Access should be limited to people who need the information.

Individual rights

D&A will take reasonable steps to recognise and respond to valid requests relating to access, correction, erasure, restriction, objection, portability and other applicable rights within required timescales.

Security and breaches

D&A uses proportionate access, authentication, supplier, awareness and disposal controls. Suspected data incidents should be escalated promptly, assessed and notified where legally required.

Suppliers and processors

Where suppliers process personal information for D&A, we aim to use appropriate contractual controls, due diligence and instructions. Where D&A processes data for a client, the relevant client agreement governs that activity.

International transfers

Restricted transfers outside the UK should only take place where an appropriate legal mechanism and safeguards are in place.

Retention and disposal

Records should be retained according to business, contractual, legal and regulatory needs and disposed of securely when no longer required.

Contact

Questions, concerns and rights requests can be sent to TeamSupport@daserviceintl.com.